CVE-2022-25927 in ua-parser-js
Summary
by MITRE • 01/26/2023
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/19/2026
The vulnerability identified as CVE-2022-25927 affects the ua-parser-js package, a widely used JavaScript library for parsing user agent strings to identify browser, operating system, and device information. This package is commonly integrated into web applications, content management systems, and analytics platforms where user agent string interpretation is critical for proper functionality and user experience. The vulnerability specifically impacts versions ranging from 0.7.30 through 0.7.32 and 0.8.1 through 1.0.32, creating a significant security risk for applications that rely on this library for client-side or server-side user agent parsing operations.
The technical flaw resides within the trim() function implementation in the ua-parser-js library, which utilizes regular expressions that are susceptible to Regular Expression Denial of Service (ReDoS) attacks. This vulnerability occurs when maliciously crafted user agent strings contain carefully constructed regular expression patterns that cause the parsing engine to enter into catastrophic backtracking states. The vulnerable regular expressions fail to properly handle certain input patterns that trigger exponential time complexity during pattern matching operations, leading to substantial computational overhead and potential system resource exhaustion. The issue is categorized under CWE-400, which specifically addresses the vulnerability of applications to resource exhaustion attacks through malformed input processing.
The operational impact of this vulnerability extends beyond simple performance degradation to potentially enable complete service disruption for affected applications. When exploited, attackers can craft user agent strings that cause the ua-parser-js library to consume excessive CPU cycles and memory resources, effectively creating a denial of service condition that can render web applications unresponsive or slow to respond. This risk is particularly pronounced in high-traffic environments where user agent parsing occurs frequently, as the cumulative effect of multiple malicious requests can overwhelm server resources and impact legitimate user access. The vulnerability affects both client-side and server-side implementations, making it a comprehensive threat to web application security architectures.
Mitigation strategies for CVE-2022-25927 involve immediate upgrading of the ua-parser-js package to versions 0.7.33 or 1.0.33 and later, which contain patched regular expression patterns that eliminate the ReDoS vulnerability. Organizations should also implement input validation and sanitization measures to filter potentially malicious user agent strings before they reach the parsing library, though this approach should complement rather than replace the primary remediation of upgrading to patched versions. Network-level protections such as rate limiting and request filtering can provide additional defense-in-depth measures, while monitoring systems should be configured to detect unusual parsing behavior or resource consumption patterns that may indicate exploitation attempts. The vulnerability demonstrates the critical importance of regularly updating third-party dependencies and conducting security assessments of open source libraries to prevent exploitation of known vulnerabilities within application ecosystems.